Privacy Policy
Effective from: 18 August 2026 · Version 1.2
1. The short version
We collect what we need to build you a website and nothing else. We do not sell your data, we do not use it for advertising, and we do not send you a newsletter. Our website analytics do not use cookies and cannot identify you. If you want your data deleted, email us and we will delete it.
The rest of this page is the same thing in detail, because you are entitled to it.
2. Who is responsible for your data
J2NV Group s. r. o. (trading as TrueBuilt) Cestice 308, 044 71 Cestice, Slovakia (European Union) Company registration number (IČO): 56721552
Email: joe@truebuiltweb.com
We are the data controller. We have not appointed a Data Protection Officer, because we are a two-person company and are not required to.
We do not ask you to consent to this policy, and you will not find a tick box for it on our form. We do not need your consent to build you the demo you asked for: the law lets us process what you send us because it is necessary for the steps you asked us to take before entering into a contract. Asking for a consent we do not rely on would only make it look as though you could switch that off — and you cannot switch off the processing that is needed to do the thing you asked for. Where we genuinely do rely on consent, we say so and you can withdraw it at any time.
3. What we collect and why
3.1 When you fill in our form
| What | Why | Legal basis |
|---|---|---|
| Your name and email | to send you your demo and quote, and to talk to you about your project | Performance of a contract / steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Your phone number, if you give it | so we can reach you if you prefer that — it is optional and we will not cold-call you | Same |
| Your business name, what you do, where you work | to build a website that is actually about your business | Same |
| Your answers about services, goals, style and tone | same | Same |
| Files you upload — logo, photos, documents | to put them on your website | Same |
| Whether the website is for a business or personal use | to work out the correct tax treatment of your quote | Legal obligation (Art. 6(1)(c) GDPR) |
| The page you came from and any campaign tags in the link | to understand which of our pages bring us enquiries | Legitimate interests (Art. 6(1)(f) GDPR) — understanding how people find us |
| A one-way fingerprint of your IP address | to stop automated spam abusing the form | Legitimate interests — keeping our service working |
| The time you spent on the form and the result of the spam checks | same | Same |
About the IP address. We do not store it. We store an irreversible cryptographic fingerprint of it, which lets us count how many submissions came from the same visitor in a day without ever holding the address itself. It cannot be turned back into an IP address.
3.2 When you order
Your payment is processed by Stripe. We never see or store your card number. Stripe collects and passes to us your billing name, billing address, country, and — if you are a business — your business name and tax or VAT number, because we are legally required to put them on your invoice.
We keep invoices and the records behind them because Slovak accounting and tax law requires us to.
3.3 When you email us
We keep the email. Our customer mailbox is hosted by Microsoft 365 in the European Union.
3.4 When you use the withdrawal form
If you withdraw from a contract using the form at /withdrawal, we record your name, email, your order reference if you gave one, anything you choose to tell us, your notice of withdrawal, and the exact date and time you sent it. We are legally required to keep this and to send you a copy.
3.4a When you ask us to start work before your 14 days are up
If you are a consumer and you ask us to begin work before your statutory withdrawal period expires, we record your name, email, order reference, the exact wording of the information you were shown and of the three statements you confirmed, the version of that wording and of our Terms, and the date and time. We are legally required to keep this and to send it to you on a durable medium.
3.5 When you just visit the website
We use Cloudflare Web Analytics. It counts page views and tells us which pages people look at and roughly where in the world they are. It does not use cookies, does not fingerprint your device, and cannot identify you or follow you across websites.
Our website sets no cookies at all. If you check your browser’s cookie storage on this site, it is empty. That is deliberate, and it is why you are not looking at a cookie banner right now.
If we ever start running online advertising, that will change, and we will put a consent banner in place before it does — not after.
3.6 What is stored in your own browser
While you fill in our form, your answers are saved in your own browser so you do not lose them if you close the tab or lose signal. This never leaves your device until you press the submit button, and you can clear it at any time by clearing your browser data.
3.7 What we do not do
- We do not sell or rent your personal data. Not to anyone, for any price.
- We do not use your data to target advertising at you.
- We do not add you to a mailing list. There isn’t one.
- We do not use your data or your uploads to train AI models, and our tool providers are not permitted to use it for that either.
- We do not make any decision about you by automated means alone.
4. How long we keep things
| What | How long | Why |
|---|---|---|
| Files you upload | 90 days, then deleted automatically | Long enough to build and revise your site; there is no reason to keep them after that |
| Your form answers, if you go on to order | For the life of the project, and afterwards for as long as the contract and our accounting obligations require | They are the record of what you asked for, and we need them if there is ever a question about the work |
| Your form answers, if you never order | Up to 3 years — see the paragraph below this table | Long enough to pick a conversation back up and to understand which of our pages bring us enquiries; after that we no longer have a reason to hold them |
| Your demo website | 60 days after our last contact, if you do not order | Then deleted |
| Invoices and accounting records | 10 years | Required by Slovak accounting and tax law |
| Consumer withdrawal records and early-performance consent records | 4 years | See the two paragraphs below this table |
| Emails | While we are working together and for a reasonable time afterwards | To answer questions about past work |
| Anti-spam fingerprints | 24 hours, then deleted automatically | They only exist to count submissions in a day |
Consumer withdrawal and early-performance consent records: retained for 4 years after completion or termination of the relevant contract, or after the exercise of the withdrawal right, whichever occurs later. Where a complaint, legal claim, regulatory inquiry or other dispute is pending, relevant records may be retained until the matter is finally resolved and the applicable legal-claim periods expire.
Accounting and tax records: retained for the period required by applicable accounting and tax law, which may be 10 years.
If you ask for a demo or a quote but never order: we keep the relevant enquiry data for up to 3 years from the date we collected it or from your last active contact with us, whichever is later — unless we no longer need it sooner, or you ask us to delete it. “Active contact” means something you did: a reply, a new enquiry, a question. Opening one of our emails does not restart the clock. We keep this to manage prospective customer relationships and to have a record of previous enquiries, and that is our legitimate interest under Art. 6(1)(f) GDPR. Three years is a maximum, not a minimum — if the enquiry is clearly dead sooner, the data goes sooner. Any files you uploaded are deleted after 90 days regardless.
The 90-day deletion of uploads is automatic, not a promise we have to remember to keep. It is a rule set on the storage itself. The other periods are not automatic, because they run from the end of a contract rather than from the day a record was created — we review them by hand once a year.
5. Who else touches your data
We use these companies. Each is bound by a contract that limits them to acting on our instructions.
| Who | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | hosts our website, stores your form answers and uploads, provides analytics and spam protection | Storage in the European Union |
| Resend (Plus Five Five, Inc.) | sends automated emails — your confirmation and our internal notifications | European Union (Ireland) |
| Microsoft Corporation | hosts our customer mailbox (Microsoft 365) | European Union |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | processes payments; Stripe is a separate controller for payment data | European Union and United States |
| Zoho Corporation | hosts the mailbox we use for business outreach — not used for customer projects | European Union |
| Anthropic PBC | we use Claude as a tool when building your website | United States |
About the last one, honestly: we build websites with the help of AI tools, and we say so openly on our website. When we do, the content of your project — your business details, your services, your materials — passes through those tools. We use them under business terms that prohibit using your data to train models. We do not put your email address, phone number, payment details or any file we do not need into them.
Some of these companies are in the United States. Transfers there are covered by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
6. Your rights
Wherever you are, you can ask us to:
- tell you what we hold about you and give you a copy;
- correct anything that is wrong;
- delete it (subject to records we are legally required to keep, such as invoices);
- restrict or object to what we do with it;
- send it to you or someone else in a machine-readable format.
If you are in the EU, the UK or Switzerland, these are your rights under the GDPR and equivalent laws.
If you are in California, you have the rights under the CCPA/CPRA to know, to delete, to correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those laws define it, so there is nothing to opt out of — but the other rights apply and we will honour them. We will not discriminate against you for exercising them.
How to use any of them: email joe@truebuiltweb.com. Say what you want. We will reply within 30 days, usually much sooner. We do not charge for this and we will not make you fill in a form.
If you think we have got it wrong, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority. Ours is:
Úrad na ochranu osobných údajov Slovenskej republiky Hraničná 12, 820 07 Bratislava, Slovakia dataprotection.gov.sk
If you live in another EU country, you can complain to your own national authority instead.
7. How we protect your data
- Everything travels over encrypted connections (HTTPS/TLS).
- Your files are stored in private storage that is not reachable from the internet. There is no public link to them, and there never has been.
- Files you upload are checked for type and content before we accept them, and are stored so that they can never be executed.
- Access to our systems is protected by two-factor authentication.
- Only two people have access: the two of us who run the company.
- We do not store card details at any point.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach ever affects your data, we will tell you and the supervisory authority within the time the law requires.
8. Children
Our service is for businesses and adults. We do not knowingly collect data from anyone under 16. If you believe a child has sent us information, email us and we will delete it.
9. Changes to this policy
If we change anything meaningful — a new company processing your data, a new purpose, a different retention period — we update the date at the top and describe the change here. If the change affects a project we are working on for you, we email you about it.
10. Contact
J2NV Group s. r. o. (trading as TrueBuilt) Cestice 308, 044 71 Cestice, Slovakia joe@truebuiltweb.com
We read every email and we answer them personally.
TrueBuilt is a brand of J2NV Group s. r. o.